A federal judge has again refused to let Onfido, an online identity verification firm, avoid a class action accusing it of violating an Illinois privacy law, as the judge ruled scans of photographs, like drivers' license photos, amount to the same thing as a scan of a person's actual face, if the scan captures a person's facial geometry.
Fredy Sosa, a member of online resale marketplace OfferUp, sued Onfido in 2020 in Cook County Circuit Court, alleging it violated the Illinois Biometric Information Privacy Act when verifying the identities of OfferUp users with its TruYou facial recognition software. Onfido removed the complaint to federal court.
In January 2021, U.S. District Judge Marvin Aspen denied Onfido’s attempt to stay Sosa’s complaint and compel individual arbitration. Onfido based its argument on a clause in OfferUp’s service contract and privacy policy, but Sosa successfully argued Onfido isn’t a party to the agreement between OfferUp and its users.
After the U.S. Seventh Circuit Court of Appeals denied Onfido’s appeal last August, the company again tried to dismiss the claims. In its most recent filings, Onfido argued BIPA doesn't apply to its activities, and because the accusations under the BIPA law violate the company's rights under the First Amendment.
Judge Aspen issued an opinion April 25 rejecting Onfido's arguments.
Sosa had alleged Onfido didn’t sufficiently comply with BIPA requirements for providing written notice to people uploading images.
In arguing for dismissal, Onfido, however, said it collects only photographs, not the raw biometric data protected under BIPA. It also challenged Sosa’s claim for liquidated damages because he didn’t adequately allege intentional, reckless or negligent BIPA violations. It also said BIPA itself violates the First Amendment.
Aspen agreed photographs shouldn't be considered biometric information under BIPA. But the judge noted Sosa contends the data Onfido gleans from the photographs constitutes biometric identifiers, which also are protected.
“Onfido’s software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image, which Sosa refers to as a ‘faceprint,'" Aspen wrote. "The faceprints extracted by Onfido plausibly constitute scans of face geometry and, therefore, ‘biometric identifiers’ under BIPA.”
Turning to Onfido’s First Amendment claim, Aspen said the BIPA section under which Sosa sued doesn’t restrict the company’s speech. Even if it did, the restriction is content neutral, meaning it still would survive First Amendment scrutiny.
Onfido argued “factual information voluntarily provided by consumers to identify themselves as marketplace users” is commercial speech. But Aspen agreed with Sosa’s contention that BIPA regulates conduct, not speech. He also noted BIPA “does nothing to restrict an entity’s sale, disclosure or use of biometric data once the data is obtained.”
Aspen also agreed with Sosa that BIPA isn’t a content-based speech restriction because there is no regard for “the message, if any even exists, communicated by a person’s biometric identifiers or biometric information,” only how companies collect and process such data. He further said that although Sosa didn’t show Onfido made any “misleading” speech, the government does have a substantial interest in protecting consumers’ privacy rights and that the General Assembly enacted BIPA to alleviate potential legal damage for people whose biometric data is compromised.
“Onfido appears to argue that Sosa consented to Onfido’s collection of his photograph by voluntarily uploading it with the understanding that the photograph would be stored, and this consent is ‘equally effective’ as the disclosures and consent” BIPA requires, Aspen wrote. “This argument is a non-starter.”
Consenting to storing an image isn’t the same as permitting a scan of facial geometry, Aspen continued. He also said BIPA isn’t overly broad, writing companies still can obtain biometric data provided they obtain informed, written consent, which isn’t an onerous requirement.
Aspen further said Sosas’s pursuit of liquid damages are merely requests for specific remedies if he wins his underlying BIPA claims. By contrast, he also seeks other relief, Aspen said, such as injunctions and legal fees, which are direct claims that don’t depend on proving the company’s alleged actions were negligent, reckless or intentional.
With the motion to dismiss denied, Aspen gave Onfido until May 16 to answer Sosa’s complaint.
Sosa and the plaintiffs' class is represented by attorneys with the firm of Edelson P.C., of Chicago.
Onfido is represented by attorneys with the firm of Baker & Hostetler, of Chicago, Orlando and Denver.